<!DOCTYPE html
  PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
  "DTD/xhtml1-strict.dtd">
<html>
  <head>
    <title>volatility.plugins.gui.win32k_core.tagDESKTOP : API documentation</title>
    <meta content="text/html;charset=utf-8" http-equiv="Content-Type" />
    <link href="apidocs.css" type="text/css" rel="stylesheet" />
    
    
  </head>
  <body>
    <h1 class="class">v.p.g.w.tagDESKTOP(<a href="volatility.plugins.gui.win32k_core.tagWINDOWSTATION.html">tagWINDOWSTATION</a>) : class documentation</h1>
    <p>
      <span id="part">Part of <a href="volatility.html">volatility</a>.<a href="volatility.plugins.html">plugins</a>.<a href="volatility.plugins.gui.html">gui</a>.<a href="volatility.plugins.gui.win32k_core.html">win32k_core</a></span>
      
      <a href="classIndex.html#volatility.plugins.gui.win32k_core.tagDESKTOP">View In Hierarchy</a>
    </p>
    <div>
      <p>Known subclasses: <a href="volatility.plugins.gui.win32k_core.tagTHREADINFO.html">volatility.plugins.gui.win32k_core.tagTHREADINFO</a></p>
    </div>
    <div>A class for Desktop objects<table class="fieldTable"></table></div>

    
    
    <div id="splitTables">
      <table class="children sortable" id="id376">
  
  
<tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core.tagDESKTOP.html#is_valid">is_valid</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core.tagDESKTOP.html#WindowStation">WindowStation</a></td>
    <td><span>Returns this desktop's parent window station</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core.tagDESKTOP.html#DeskInfo">DeskInfo</a></td>
    <td><span>Returns the desktop info object</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core.tagDESKTOP.html#threads">threads</a></td>
    <td><span>Generator for _EPROCESS objects attached to this desktop</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core.tagDESKTOP.html#hook_params">hook_params</a></td>
    <td><span>Parameters for the hooks() method.</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core.tagDESKTOP.html#hooks">hooks</a></td>
    <td><span>Generator for tagHOOK info.</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core.tagDESKTOP.html#windows">windows</a></td>
    <td><span>Traverses windows in their Z order, bottom to top.</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core.tagDESKTOP.html#heaps">heaps</a></td>
    <td><span>Generator for the desktop heaps</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core.tagDESKTOP.html#traverse">traverse</a></td>
    <td><span>Generator for next desktops in the list</span></td>
  </tr>
  
</table>
      
        <p>
          Inherited from <a href="volatility.plugins.gui.win32k_core.tagWINDOWSTATION.html">tagWINDOWSTATION</a>:
        </p>
        <table class="children sortable" id="id377">
  
  
<tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core.tagWINDOWSTATION.html#PhysicalAddress">PhysicalAddress</a></td>
    <td><span>This is a simple wrapper to always return the object's physical offset regardless of what AS its instantiated in</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core.tagWINDOWSTATION.html#LastRegisteredViewer">LastRegisteredViewer</a></td>
    <td><span>The EPROCESS of the last registered clipboard viewer</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core.tagWINDOWSTATION.html#AtomTable">AtomTable</a></td>
    <td><span>This atom table belonging to this window station object</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core.tagWINDOWSTATION.html#Interactive">Interactive</a></td>
    <td><span>Check if a window station is interactive</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core.tagWINDOWSTATION.html#Name">Name</a></td>
    <td><span>Get the window station name.</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.gui.win32k_core.tagWINDOWSTATION.html#desktops">desktops</a></td>
    <td><span>A generator that yields the window station's desktops</span></td>
  </tr>
  
</table>
      
        <p>
          Inherited from <a href="volatility.obj.CType.html">CType</a> (via <a href="volatility.plugins.gui.win32k_core.tagWINDOWSTATION.html">tagWINDOWSTATION</a>):
        </p>
        <table class="children sortable" id="id378">
  
  
<tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.CType.html#__init__">__init__</a></td>
    <td><span>This must be instantiated with a dict of members. The keys are the offsets, the values are Curried Object classes that will be instantiated when accessed.</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.CType.html#size">size</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.CType.html#__repr__">__repr__</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.CType.html#d">d</a></td>
    <td><span>Display diagnostic information</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.CType.html#v">v</a></td>
    <td><span>When a struct is evaluated we just return our offset.</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.CType.html#m">m</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.CType.html#__getattr__">__getattr__</a></td>
    <td><span>This is only useful for proper methods (not ones that start with __ )</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.CType.html#__setattr__">__setattr__</a></td>
    <td><span>Change underlying members</span></td>
  </tr>
  
</table>
      
        <p>
          Inherited from <a href="volatility.obj.BaseObject.html">BaseObject</a> (via <a href="volatility.plugins.gui.win32k_core.tagWINDOWSTATION.html">tagWINDOWSTATION</a>, <a href="volatility.obj.CType.html">CType</a>):
        </p>
        <table class="children sortable" id="id379">
  
  
<tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#obj_type">obj_type</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#obj_vm">obj_vm</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#obj_offset">obj_offset</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#obj_parent">obj_parent</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#obj_name">obj_name</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#obj_native_vm">obj_native_vm</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#set_native_vm">set_native_vm</a></td>
    <td><span>Sets the native_vm</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#rebase">rebase</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#proxied">proxied</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#newattr">newattr</a></td>
    <td><span>Sets a new attribute after the object has been created</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#write">write</a></td>
    <td><span>Function for writing the object back to disk</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#__nonzero__">__nonzero__</a></td>
    <td><span class="undocumented">No summary</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#__eq__">__eq__</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#__ne__">__ne__</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#__hash__">__hash__</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#dereference">dereference</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#dereference_as">dereference_as</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#cast">cast</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#__format__">__format__</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#__str__">__str__</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#__getstate__">__getstate__</a></td>
    <td><span>This controls how we pickle and unpickle the objects</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#__setstate__">__setstate__</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr>
  
</table>
      
      
    </div>
    
    
    

    <div class="function">
  <a name="volatility.plugins.gui.win32k_core.tagDESKTOP.is_valid">
    
  </a>
  <a name="is_valid">
    
  </a>
  <div class="functionHeader">
    
    def
    is_valid(self):
    
  </div>
  <div class="functionBody">
    <div class="interfaceinfo">overrides <a href="volatility.plugins.gui.win32k_core.tagWINDOWSTATION.html#is_valid">volatility.plugins.gui.win32k_core.tagWINDOWSTATION.is_valid</a></div>
    <div class="undocumented">Undocumented</div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.gui.win32k_core.tagDESKTOP.WindowStation">
    
  </a>
  <a name="WindowStation">
    
  </a>
  <div class="functionHeader">
    @property<br />
    def
    WindowStation(self):
    
  </div>
  <div class="functionBody">
    
    <div>Returns this desktop's parent window station<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.gui.win32k_core.tagDESKTOP.DeskInfo">
    
  </a>
  <a name="DeskInfo">
    
  </a>
  <div class="functionHeader">
    @property<br />
    def
    DeskInfo(self):
    
  </div>
  <div class="functionBody">
    
    <div>Returns the desktop info object<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.gui.win32k_core.tagDESKTOP.threads">
    
  </a>
  <a name="threads">
    
  </a>
  <div class="functionHeader">
    
    def
    threads(self):
    
  </div>
  <div class="functionBody">
    
    <div>Generator for _EPROCESS objects attached to this desktop<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.gui.win32k_core.tagDESKTOP.hook_params">
    
  </a>
  <a name="hook_params">
    
  </a>
  <div class="functionHeader">
    
    def
    hook_params(self):
    
  </div>
  <div class="functionBody">
    
    <div>Parameters for the hooks() method.</p>
<p>These are split out into a function so it can be
subclassed by tagTHREADINFO.<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.gui.win32k_core.tagDESKTOP.hooks">
    
  </a>
  <a name="hooks">
    
  </a>
  <div class="functionHeader">
    
    def
    hooks(self):
    
  </div>
  <div class="functionBody">
    
    <div>Generator for tagHOOK info.</p>
<p>Hooks are carved using the same algorithm, but different
starting points for desktop hooks and thread hooks. Thus
the algorithm is presented in this function and the starting
point is acquired by calling hook_params (which is then sub-
classed by tagTHREADINFO.<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.gui.win32k_core.tagDESKTOP.windows">
    
  </a>
  <a name="windows">
    
  </a>
  <div class="functionHeader">
    
    def
    windows(self, win, filter=True, level=0):
    
  </div>
  <div class="functionBody">
    
    <div>Traverses windows in their Z order, bottom to top.</p>
<p>&#64;param win: an HWND to start. Usually this is the desktop
window currently in focus.</p>
<p>&#64;param filter: a callable (usually lambda) to use for filtering
the results. See below for examples:</p>
<p># only print subclassed windows
filter = lambda x : x.lpfnWndProc == x.pcls.lpfnWndProc</p>
<p># only print processes named csrss.exe
filter = lambda x : str(x.head.pti.ppi.Process.ImageFileName).lower()                                 == &quot;csrss.exe&quot; if x.head.pti.ppi else False</p>
<p># only print processes by pid
filter = lambda x : x.head.pti.pEThread.Cid.UniqueThread == 0x1020</p>
<p># only print visible windows
filter = lambda x : 'WS_VISIBLE' not in x.get_flags()<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.gui.win32k_core.tagDESKTOP.heaps">
    
  </a>
  <a name="heaps">
    
  </a>
  <div class="functionHeader">
    
    def
    heaps(self):
    
  </div>
  <div class="functionBody">
    
    <div>Generator for the desktop heaps<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.gui.win32k_core.tagDESKTOP.traverse">
    
  </a>
  <a name="traverse">
    
  </a>
  <div class="functionHeader">
    
    def
    traverse(self):
    
  </div>
  <div class="functionBody">
    <div class="interfaceinfo">overrides <a href="volatility.plugins.gui.win32k_core.tagWINDOWSTATION.html#traverse">volatility.plugins.gui.win32k_core.tagWINDOWSTATION.traverse</a></div>
    <div>Generator for next desktops in the list<table class="fieldTable"></table></div>
  </div>
</div>
    <address>
      <a href="index.html">API Documentation</a> for Volatility 2.2, generated by <a href="http://codespeak.net/~mwh/pydoctor/">pydoctor</a> at 2013-06-24 15:16:10.
    </address>
  </body>
</html>